PT-2018-10528 · Moodle · Moodle

Brendan Cox · Published 2018-05-25 · Updated 2022-05-14 · CVE-2018-1137

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x

Description An issue was discovered that allows users to instantiate any class by substituting URLs in portfolios. This can be exploited by users who are logged in as guests to create a DDoS attack.

Recommendations For Moodle versions 3.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-1137

GHSA-VXQH-MX28-7GHW

Affected Products

Moodle

References · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1137 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1137 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1137 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1137 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1137 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=371204 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vxqh-mx28-7ghw · Vendor Advisory
• https://github.com/moodle/moodle · Note
• http://securityfocus.com/bid/104307 · Note